NSClient++ 0.12.4.0 ڈاؤن لوڈ

0.12.4 — Regression fixes for Icinga and CheckSystem
This is a maintenance release focused on regressions introduced since 0.12.3.
No new features; no breaking changes for configurations that don't hit the items below.
Highlights
- Icinga check_nscp_api works again. The query-string credential path was removed in 0.12.3 for security (commit
340b8db1). That hardening broke Icinga's bundled check_nscp_api plugin, which still passes the password as
?password=.... This release reinstates the legacy path behind a User-Agent allowlist (default: clients whose
User-Agent matches Icinga/check_nscp_api) — every other client keeps the strict post-340b8db1 rejection.
- Better "module not found" messages on Windows. When a configured module fails to load, the error now points at the
WiX installer feature that ships the module (e.g. NRPEServer → "NRPE Support"), so operators
can fix the cause (re-run the installer and tick that feature) without reading source.
- IcingaClient.dll is now in the installer. The DLL was being built but not packaged, so the corresponding
Op5/Icinga client features were unusable on stock Windows installs.
- os_updates.status keyword renamed to update_status. The previous name clashed with the built-in status
keyword every check exposes, which made filter / detail-syntax expressions ambiguous on check_os_updates. Any custom
config that referenced os_updates.status must be updated — see Behaviour change below.
- check_wmi no longer crashes on warn/crit filters. A use-after-mutation in the WMI row iterator caused an access
violation whenever a warn= or crit= filter touched a column value (e.g.
check_wmi "query=Select Version from win32_OperatingSystem" "warn=Version not like '6.3'"). Affected every
filter that exercised the post-iteration deferred-evaluation path.
Detailed changes
WebServer — legacy query-string authentication restored for specific clients (94b2057d)
The 0.12.3 hardening removed three paths because URL-borne credentials and tokens leak into browser history, proxy logs,
and Referer headers:
- GET/POST /auth/token?password=...
- GET/POST /auth/logout?token=...
- ?TOKEN=... / ?__TOKEN=... as a session-token fallback on any endpoint
Removing them broke Icinga's bundled check_nscp_api plugin, which still ships with the query-string mechanism. To
unblock that integration without re-opening the vector to browsers and arbitrary scrapers, this release gates the legacy
paths on a User-Agent allowlist:
- New setting [/settings/WEB/server] legacy query auth user agents. Comma-separated list of User-Agent substrings (
case-insensitive). A request whose User-Agent contains any pattern is allowed to use the legacy query-string
mechanism; everything else still gets the 0.12.3 rejection (410 Gone on /auth/*, 403 on ?TOKEN=).
- Default: Icinga/check_nscp_api — anchors on the specific plugin name, so unrelated tooling that merely mentions "
Icinga" in its User-Agent doesn't slip through.
- Set to an empty string to disable the fallback entirely (matches the strict 0.12.3 behaviour).
- The 410 / 403 rejection log lines now mention this setting as the escape hatch so operators don't have to dig through
source to find it.
Security posture, in short: this is not a defence against malicious clients — an attacker can spoof the User-Agent — but
it keeps the legacy vector off the default surface for browsers, scrapers, and anything else that isn't
check_nscp_api.
Service — installer-feature hints in module-load errors (793c3ee1)
When a referenced module's DLL isn't on disk (typically because the operator didn't tick the relevant feature in the
Windows installer), the error now ends with a hint:
Failed to load NRPEServer: <reason> (module 'NRPEServer' is part of the 'NRPE Support' installer feature; re-run the
NSClient++ installer and enable that feature, or see installers/installer-NSCP/Product.wxs for the full feature map)
Covers every module shipped by the MSI: CheckPlugins (the bulk of check_* modules), NRPE Support, Check MK Support,
NSCA / NSCA-NG, WEB Server, Lua / Python scripting, OP5 / Elastic / Icinga client, etc.
Hint is Windows-only — on Linux the package manager handles module installation and the hint would be misleading.
Installer — IcingaClient.dll added (3a9af3cf)
IcingaClient.dll is built by the CheckSystem solution but was missing from Product.wxs, so it was never shipped. The
Op5 → Icinga integration path was effectively broken on stock Windows installs. The DLL is now in the "Various client
plugins" feature alongside GraphiteClient, SMTPClient, SyslogClient, etc.
CheckSystem — check_os_updates keyword rename (cf3613e2)
The check_os_updates filter previously exposed a per-item field called status (overall update status: up_to_date /
pending / error).
Every check also exposes a built-in top-level status (OK / WARNING / CRITICAL / UNKNOWN), so filter and detail-syntax
expressions like status = 'pending' were ambiguous — a regression caught by users upgrading from 0.11.x. The per-item
field has been renamed to update_status.
The built-in status keyword (OK/WARNING/CRITICAL) is unaffected.
Upgrade notes
- Icinga users: check_nscp_api should start working again after the upgrade with no config changes. If you have a
non-stock Icinga probe that uses a different binary name, set [/settings/WEB/server] legacy query auth user agents
to a substring matching its User-Agent (or to plain Icinga to broaden the match beyond the default).
- Strict-deployment operators: if you want the strict 0.12.3 behaviour (no query-string credentials, no exceptions),
set [/settings/WEB/server] legacy query auth user agents = (empty).
Full Changelog: https://github.com/mickem/nscp/compare/0.12.3...0.12.4